You advise on the obligation. You also carry it.
A practice holds client financials, staff records, KYC documents and years of correspondence. That makes it a Data Fiduciary in its own right, and often a processor for its clients as well — before a single client conversation about their compliance has happened.
Built for: Chartered accountancy and company secretary practices, law firms, consultancies and advisory firms.
The pressure points, specifically
Client data is the whole business
Financials, PAN and Aadhaar copies, payroll files, board papers. A practice holds a concentration of personal data that most of its clients would consider critical, usually across email, a shared drive and a practice management tool.
You are a processor for some of it
Where you process personal data on a client's instructions, the client is the fiduciary and you are their processor — which means a contract, and means their exposure runs through you.
Advising without a position of your own is awkward
It is difficult to run a DPDP readiness engagement for a client whose first question is what you did about your own. The firms that get furthest with this practice on themselves first.
Every engagement has a retention tail
Files kept for statutory periods, working papers kept for professional standards, and correspondence kept because nobody deleted it. Each needs a stated basis and an end date.
The parts that matter here
A client and engagement register built for a practice
A professional-services profile with a register of clients and engagements, so the question of which personal data you hold, for whom, and under what engagement has a recorded answer rather than an institutional one.
A rights link you can host for clients
A firm-hosted route for data principal requests that your clients can publish, letting a small client meet the intake obligation through your practice instead of building something they will not maintain.
Your own consent and notice position
Purposes, lawful bases and notices for your own client and staff processing, on the same ledger you would put a client on. Practising on yourself is both the cheapest pilot and the most persuasive reference.
A neutral discovery checklist
A structured DPDP discovery you can run in a client meeting without it reading as a product pitch, which is usually how the first engagement starts.
A partner relationship if you want one
Firms that end up recommending the platform to clients can formalise it — refer, sell with us, or deliver the implementation yourselves. The shape is worked out per practice.
Professional services and the DPDP Act
Yes. A practice determines the purpose and means of processing personal data belonging to its clients' directors, employees and counterparties, as well as its own staff and prospects, which makes it a Data Fiduciary. Where it processes purely on a client's instructions it is additionally that client's Data Processor, and needs a contract on that footing.
It depends on the engagement, and it is often both across different files. If the client tells you what to do with the data and you do only that, you are their processor. If you decide what to collect and why — running your own KYC, keeping your own working papers, marketing to a prospect list — you are a fiduciary for that processing and carry the full obligation.
Yes, and many practices are. The commercial question is whether you resell a platform, implement one, or simply refer clients to it, and the answer usually depends on whether your practice wants to carry delivery. What matters legally is being clear about where advice ends and where a product claim begins.
Map what personal data the firm itself holds and under which engagement, because that is both the obligation you carry today and the exercise you will be selling to clients tomorrow. A client and engagement register makes that concrete; a privacy notice and a rights intake route follow from it.
General information about the DPDP Act, 2023, not legal advice. For a position specific to your organisation, talk to us.
Find out where you actually stand.
The free self-assessment takes a few minutes and gives you a written position on your own setup, not a generic checklist.